Blue team notes, built in the open
Practical walkthroughs on alert triage, detection engineering, incident response and threat hunting. Written step by step, with queries you can copy and labs you can repeat.
Live
Latest
Scope unauthorised AnyDesk, ScreenConnect and TeamViewer use across a client estate: find every install, read the session logs, build a timeline and contain it safely.
A repeatable workflow for public sector SOCs to turn NCSC co-sealed advisories into ATT&CK mapped hunts, tested detections and clear evidence for the CAF.
Spot adversary in the middle phishing in Entra ID by tracking session IDs, OfficeHome sign ins and token risk events, then contain it before a payment fraud lands.
Where Linux keeps SSH logs, what each common log line means and the simple grep and journalctl commands that tell you who logged in, from where and how.
A beginner friendly plan for a home SOC lab using Windows evaluation builds, Sysmon, a free SIEM and Atomic Red Team, plus how to turn it into interview evidence.
A practical workflow for investigating an unknown domain with internal logs, RDAP, passive DNS and certificate data, then turning the results into a clear verdict.
Topics
Learning path
Tiers, shifts, the alert lifecycle and the tools you will touch on day one.
Open track →A repeatable workflow for reading alerts, enriching indicators and reaching a verdict.
Open track →Write, test and tune rules so the SOC sees the right things with less noise.
Open track →Contain, investigate and report, using a structure that holds up under pressure.
Open track →Short threads on detections, event IDs, triage tricks and new posts as they go live.